@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaRecovery.js

@@ -1,15 +1,15 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildEvmFamilyEcdsaWalletKey } from "../identity/evmFamilyEcdsaIdentity.js";
-import { parseSigningSessionSealKeyVersion } from "../keyMaterialBrands.js";
+import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseEmailOtpWorkerIssuedSessionHandle } from "../../../platform/secretSources.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../persistence/ecdsaRoleLocalRecords.js";
 import { buildEmailOtpAuthContextForWalletAuthMethod, emailOtpAuthContextProviderUserId, emailOtpAuthContextRetention } from "../identity/laneIdentity.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { buildCanonicalEvmFamilyEcdsaSigningCapability, buildExactEvmFamilyWalletSessionAuthorization } from "../material/ecdsaSigningCapability.js";
 import { buildPersistedEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 import { requestRehydrateEmailOtpEcdsaWarmSessionMaterial } from "./workerRequests.js";
 import { emailOtpEcdsaSealAuthorizationThresholdSessionId } from "./ecdsaPublication.js";
 import { buildEmailOtpRecoveredKeyActivation } from "./ecdsaLogin.js";
@@ -147,7 +147,7 @@ async function restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecord(args)
 	if (sealedRecord.authMethod !== "email_otp" || sealedRecord.curve !== "ecdsa") return null;
 	const materialActivation = sealedRecord.roleLocalMaterialRef.materialActivation;
 	return await args.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
 		walletId: toWalletId(sealedRecord.walletId),
 		enabled: true,
 		task: async () => await restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecordInQueue(args)

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaSigningSessionAuthority.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
+import { walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { buildCanonicalEvmFamilyEcdsaSigningCapability, buildExactEvmFamilyWalletSessionAuthorization } from "../material/ecdsaSigningCapability.js";
 import { buildPersistedEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
 import { resolveExactWalletAuthAuthority } from "../identity/ownerLaneScope.js";

package/dist/esm/core/signingEngine/session/emailOtp/ed25519ExportContext.js

@@ -1,10 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseEd25519YaoRecoveryCapabilityV1 } from "../passkey/ed25519YaoRecoveryCapability.js";
 //#region src/core/signingEngine/session/emailOtp/ed25519ExportContext.ts
 function isEd25519YaoClientRootEnvelopeV1(envelope) {
@@ -14,19 +15,11 @@ function requireEd25519YaoClientRootEnvelopeV1(envelope) {
 	if (!isEd25519YaoClientRootEnvelopeV1(envelope)) throw new Error("[SigningEngine][ed25519-export] export envelope has the wrong secret kind");
 	return envelope;
 }
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, expected, label) {
 	const actual = Object.keys(record).sort();
 	const keys = [...expected].sort();
 	if (actual.length !== keys.length || actual.some((key, index) => key !== keys[index])) throw new Error(`${label} fields are invalid`);
 }
-function requireString(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is invalid`);
-	return value;
-}
 function requirePositiveInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} is invalid`);
 	return value;
@@ -84,9 +77,9 @@ async function readColdExportBootstrap(input) {
 		"capability"
 	], "Ed25519 export bootstrap");
 	if (record.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("Ed25519 export bootstrap kind is invalid");
-	const walletId = requireString(record.walletId, "bootstrap.walletId");
-	const nearAccountId = requireString(record.nearAccountId, "bootstrap.nearAccountId");
-	const nearEd25519SigningKeyId = requireString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
+	const walletId = requireCanonicalString(record.walletId, "bootstrap.walletId");
+	const nearAccountId = requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId");
+	const nearEd25519SigningKeyId = requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
 	const thresholdSessionId = parseThresholdEd25519SessionId(record.thresholdSessionId);
 	const walletSessionId = parseWalletSessionId(record.walletSessionId);
 	const quotaId = parseMpcWalletSigningQuotaId(record.quotaId);
@@ -100,7 +93,7 @@ async function readColdExportBootstrap(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireString(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
 	return {
 		emailHashHex: authority.verifier.emailHashHex,
 		bootstrap: {
@@ -202,7 +195,7 @@ async function readLinkedExportCapability(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireString(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireString(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireString(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireCanonicalString(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
 	return capability;
 }
 function countExactEd25519ExportSubjects(subjects, expectedMaterialActivation) {

package/dist/esm/core/signingEngine/session/emailOtp/exportRecovery.js

@@ -1,5 +1,5 @@
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
 import { throwEmailOtpSigningSessionAuthStateError } from "./routePlan.js";
 import { exportEcdsaDerivationKey } from "../../flows/recovery/ecdsaDerivationExport.js";
@@ -131,7 +131,7 @@ function buildExportChallengeRoutePlan(ports, args) {
 		});
 	}
 }
-function buildEcdsaExportVerificationRoutePlan(authorization) {
+function buildEcdsaExportVerificationRoutePlan(_authorization) {
 	return buildEmailOtpRoutePlan({
 		routeFamily: "login",
 		operation: WALLET_EMAIL_OTP_EXPORT_OPERATION

package/dist/esm/core/signingEngine/session/emailOtp/exportRecoveryRuntime.js

@@ -43,15 +43,6 @@ var EmailOtpExportRecoveryRuntime = class {
 			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
 		};
 	}
-	signingSessionWorkerPorts() {
-		return {
-			getSignerWorkerContext: this.ports.getSignerWorkerContext,
-			requireRelayUrl: this.ports.requireRelayUrl,
-			requireSigningSessionSealGroupId: this.ports.requireSigningSessionSealGroupId,
-			resolveSelectedWalletAuthority: this.ports.resolveSelectedWalletAuthority,
-			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
-		};
-	}
 };
 //#endregion
 export { EmailOtpExportRecoveryRuntime };

package/dist/esm/core/signingEngine/session/emailOtp/publicTypes.js

@@ -1,7 +1,6 @@
 import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import "../../../../shared-ts/src/authorization/walletAuthority.js";
-import "../../../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
+import "../../../../shared-ts/src/authorization/walletAuthority.js";
 //#region src/core/signingEngine/session/emailOtp/publicTypes.ts
 function parseEmailOtpUnlockEd25519Identity(record) {
 	const materialActivation = parseMpcMaterialActivationRef(record.materialActivation);

package/dist/esm/core/signingEngine/session/emailOtp/sealedRefreshPolicy.js

@@ -1,4 +1,3 @@
-import { createDeleteDurableSealedSessionCommand } from "../persistence/durableSealedSessionCommands.js";
 //#region src/core/signingEngine/session/emailOtp/sealedRefreshPolicy.ts
 var EmailOtpSealedRefreshPolicy = class {
 	constructor(ports) {
@@ -11,33 +10,6 @@ var EmailOtpSealedRefreshPolicy = class {
 			chainTarget: purpose.chainTarget
 		};
 	}
-	/** Corrupt persisted state or explicit user removal only. Expiry and
-	* exhaustion never reach here. */
-	async deleteEmailOtpDurableSealedSessionRecord(args) {
-		const thresholdSessionId = String(args.purpose.thresholdSessionId || "").trim();
-		if (!thresholdSessionId) {
-			this.ports.clearEcdsaRestoreCaches();
-			return;
-		}
-		const command = createDeleteDurableSealedSessionCommand({
-			durableRecord: {
-				authMethod: "email_otp",
-				curve: "ecdsa",
-				thresholdSessionId,
-				chainTarget: args.purpose.chainTarget
-			},
-			deleteReason: args.deleteReason,
-			preserveResolvedIdentity: false
-		});
-		await this.ports.deleteDurableSealedSessionRecord(command).catch(() => void 0);
-		this.ports.clearEcdsaRestoreCaches();
-	}
-	async recordSessionMaterialClaimed(purpose, result) {
-		await this.recordSessionPolicyResult({
-			purpose,
-			result
-		});
-	}
 	async recordSessionUseConsumed(purpose, result) {
 		await this.recordSessionPolicyResult({
 			purpose,

package/dist/esm/core/signingEngine/session/emailOtp/sealedSessionRegistry.js

@@ -1,5 +1,5 @@
 import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { buildCurrentSealedSessionRecord } from "../persistence/sealedSessionStore.js";
+import { buildCurrentSealedSessionRecord } from "../persistence/sealedSessionRecords.js";
 import { persistEmailOtpEcdsaSigningSessionForRefresh } from "./ecdsaPublication.js";
 //#region src/core/signingEngine/session/emailOtp/sealedSessionRegistry.ts
 var EmailOtpSealedSessionRegistry = class {

package/dist/esm/core/signingEngine/session/emailOtp/walletUnlock.js

@@ -1,5 +1,5 @@
-import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 //#region src/core/signingEngine/session/emailOtp/walletUnlock.ts
 async function unlockEmailOtpAuthorityWallet(args) {
 	return await args.workerCtx.requestWorkerOperation({

package/dist/esm/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js

@@ -1,11 +1,11 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { deriveEvmFamilySigningKeySlotId as deriveEvmFamilySigningKeySlotId$1 } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId, walletIdFromWalletProfile } from "../../interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
+import { deriveEvmFamilySigningKeySlotId as deriveEvmFamilySigningKeySlotId$1 } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import "../../../../shared-ts/src/signing-lanes/index.js";
 import { SigningSessionIds } from "../operationState/types.js";
 //#region src/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.ts

package/dist/esm/core/signingEngine/session/identity/exactSigningLaneIdentity.js

@@ -1,6 +1,6 @@
 import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { isImplicitNearAccountId, parseNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { buildImplicitNearAccountBinding, buildNamedNearAccountBinding, buildNearEd25519SignerBinding, buildWalletIdentity, nearEd25519SignerBindingFromRaw } from "../../../../shared-ts/src/utils/walletCapabilityBindings.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { SigningSessionIds } from "../operationState/types.js";

package/dist/esm/core/signingEngine/session/identity/laneIdentity.js

@@ -1,9 +1,10 @@
-import { buildEmailOtpWalletAuthAuthority, emailOtpWalletAuthAuthorityEmailHashHex, emailOtpWalletAuthAuthorityProvider, emailOtpWalletAuthAuthorityProviderUserId } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { signingLaneAuthMethod } from "./signingLaneAuthBinding.js";
 import { SigningSessionIds } from "../operationState/types.js";
 import { toEvmFamilyEcdsaKeyHandle } from "./evmFamilyEcdsaIdentity.js";
 import { buildEvmFamilyEcdsaSignerBinding, exactEcdsaSigningLaneIdentity, exactEd25519SigningLaneIdentity, nearEd25519SignerBindingFromBoundaryFields } from "./exactSigningLaneIdentity.js";
 import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
+import { buildEmailOtpWalletAuthAuthority, emailOtpWalletAuthAuthorityEmailHashHex, emailOtpWalletAuthAuthorityProvider, emailOtpWalletAuthAuthorityProviderUserId } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+//#region src/core/signingEngine/session/identity/laneIdentity.ts
 function emailOtpAuthContextProviderUserId(context) {
 	return String(emailOtpWalletAuthAuthorityProviderUserId(context.authority));
 }
@@ -149,9 +150,9 @@ function selectedEcdsaLane(input) {
 		authorization: input.authorization
 	};
 }
-/** Shared Refactor 92 classification of a session's runtime allowance and
-* expiry. Expiry is checked before exhaustion so an expired session is never
-* reported as merely out of uses. */
+/** Shared classification of a session's runtime allowance and expiry. Expiry
+* is checked before exhaustion so an expired session is never reported as
+* merely out of uses. */
 function laneCandidateStateFromRuntimePolicy(args) {
 	const nowMs = Math.floor(Number(args.nowMs) || Date.now());
 	if (args.expiresAtMs <= nowMs) return "expired";

package/dist/esm/core/signingEngine/session/identity/ownerLaneScope.js

@@ -1,6 +1,6 @@
-import { parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toRpId } from "./evmFamilyEcdsaIdentity.js";
 import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
+import { parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/signingEngine/session/identity/ownerLaneScope.ts
 var OwnerLaneScopeIntegrityError = class extends Error {
 	constructor(message) {

package/dist/esm/core/signingEngine/session/identity/selectLane.js

@@ -35,9 +35,7 @@ function nearEd25519TransactionReauthState(lane) {
 	if (lane.state === "exhausted") return "exhausted";
 	return null;
 }
-function nearEd25519TransactionReadyAvailableLaneProjection(lane) {
-	const state = nearEd25519TransactionReadyState(lane);
-	if (!state) throw new Error("[SigningSessionSelectLane] Ed25519 lane is not transaction-ready");
+function nearEd25519TransactionAvailableLaneProjection(lane, state) {
 	return {
 		auth: lane.auth,
 		curve: "ed25519",
@@ -57,27 +55,15 @@ function nearEd25519TransactionReadyAvailableLaneProjection(lane) {
 		...lane.updatedAtMs == null ? {} : { updatedAtMs: lane.updatedAtMs }
 	};
 }
+function nearEd25519TransactionReadyAvailableLaneProjection(lane) {
+	const state = nearEd25519TransactionReadyState(lane);
+	if (!state) throw new Error("[SigningSessionSelectLane] Ed25519 lane is not transaction-ready");
+	return nearEd25519TransactionAvailableLaneProjection(lane, state);
+}
 function nearEd25519TransactionReauthAvailableLaneProjection(lane) {
 	const state = nearEd25519TransactionReauthState(lane);
 	if (!state) throw new Error("[SigningSessionSelectLane] Ed25519 lane is not transaction-reauthable");
-	return {
-		auth: lane.auth,
-		curve: "ed25519",
-		chain: "near",
-		materialActivation: lane.materialActivation,
-		walletId: lane.walletId,
-		nearAccountId: lane.nearAccountId,
-		nearEd25519SigningKeyId: lane.nearEd25519SigningKeyId,
-		signerSlot: lane.signerSlot,
-		authorizationState: "authorized",
-		authorization: lane.authorization,
-		state,
-		thresholdSessionId: lane.thresholdSessionId,
-		...lane.remainingUses == null ? {} : { remainingUses: lane.remainingUses },
-		...lane.expiresAtMs == null ? {} : { expiresAtMs: lane.expiresAtMs },
-		...lane.policyHint ? { policyHint: lane.policyHint } : {},
-		...lane.updatedAtMs == null ? {} : { updatedAtMs: lane.updatedAtMs }
-	};
+	return nearEd25519TransactionAvailableLaneProjection(lane, state);
 }
 function selectedEd25519LaneForTransactionCandidate(candidate) {
 	return selectedEd25519Lane({

package/dist/esm/core/signingEngine/session/keyMaterialBrands.js

@@ -1,18 +1,8 @@
 import { parseMpcMaterialActivationRef } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { parseNonEmptyBrand } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 //#region src/core/signingEngine/session/keyMaterialBrands.ts
-function parseNonEmptyBrand(value, label) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`${label} must be a non-empty string`);
-	return normalized;
-}
-function parseSigningSessionSealKeyVersion(value) {
-	return parseNonEmptyBrand(value, "signing-session seal key version");
-}
-function parseEcdsaClientVerifyingShareB64u(value) {
-	return parseNonEmptyBrand(value, "ECDSA client verifying share");
-}
 function parseEcdsaClientVerifyingPublicKey33B64u(value) {
 	if (typeof value !== "string") throw new Error("ECDSA client verifying public key must be a string");
 	const normalized = value.trim();
@@ -27,15 +17,9 @@ function parseEcdsaClientVerifyingPublicKey33B64u(value) {
 	if (bytes[0] !== 2 && bytes[0] !== 3) throw new Error("ECDSA client verifying public key must be compressed secp256k1");
 	return normalized;
 }
-function parseEcdsaRelayerKeyId(value) {
-	return parseNonEmptyBrand(value, "ECDSA relayer key id");
-}
 function parseEcdsaThresholdKeyId(value) {
 	return parseSdkEcdsaDerivationThresholdKeyId(value);
 }
-function parseEcdsaKeyHandle(value) {
-	return parseNonEmptyBrand(value, "ECDSA key handle");
-}
 function parseEcdsaRoleLocalMaterialHandle(value) {
 	return parseNonEmptyBrand(value, "ECDSA role-local material handle");
 }
@@ -85,10 +69,7 @@ function parseEcdsaRoleLocalWorkerHandle(value) {
 		durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(record.durableMaterialRef)
 	};
 }
-function formatEcdsaKeyHandleForWire(value) {
-	return value;
-}
 //#endregion
-export { formatEcdsaKeyHandleForWire, parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaRoleLocalMaterialHandle, parseEcdsaRoleLocalPersistedMaterialRef, parseEcdsaRoleLocalWorkerHandle, parseEcdsaThresholdKeyId, parseSigningSessionSealKeyVersion };
+export { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaRoleLocalMaterialHandle, parseEcdsaRoleLocalPersistedMaterialRef, parseEcdsaRoleLocalWorkerHandle, parseEcdsaThresholdKeyId };
 
 //# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.js

@@ -1,12 +1,13 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { isActiveEcdsaWalletAuthorityV1, isCombinedWalletSignerActivationSetV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { buildBaseEvmFamilyEcdsaKeyIdentity, buildPasskeyEcdsaAuthBinding, buildResolvedEvmFamilyEcdsaKey, buildVerifiedEcdsaPublicFacts, deriveEvmFamilyEcdsaKeyHandle, toRpId, toThresholdOwnerAddress } from "../identity/evmFamilyEcdsaIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { buildBaseEvmFamilyEcdsaKeyIdentity, buildPasskeyEcdsaAuthBinding, buildResolvedEvmFamilyEcdsaKey, buildVerifiedEcdsaPublicFacts, deriveEvmFamilyEcdsaKeyHandle, toRpId, toThresholdOwnerAddress } from "../identity/evmFamilyEcdsaIdentity.js";
+import { sameEcdsaSourceSigner, sameEcdsaTarget } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
+import { isActiveEcdsaWalletAuthorityV1, isCombinedWalletSignerActivationSetV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { resolveLinkedEcdsaHolderRuntimeV1 } from "./linkedEcdsaHolderRuntime.js";
 import { bytesToHex } from "../../chains/evm/bytes.js";
 //#region src/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.ts
@@ -72,14 +73,8 @@ function normalSigningAddress(normalSigning) {
 		return null;
 	}
 }
-function linkedEcdsaSourceSignerIdentitiesEqual(left, right) {
-	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;
-}
-function linkedEcdsaTargetRecipientPreparationsEqual(left, right) {
-	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.targetDeviceId === right.targetDeviceId && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
-}
 function linkedEcdsaSourceContributionBindingsEqual(left, right) {
-	return left.linkSessionId === right.linkSessionId && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && linkedEcdsaSourceSignerIdentitiesEqual(left.source, right.source) && linkedEcdsaTargetRecipientPreparationsEqual(left.target, right.target) && left.targetClientPublicKey33B64u === right.targetClientPublicKey33B64u;
+	return left.linkSessionId === right.linkSessionId && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && sameEcdsaSourceSigner(left.source, right.source) && sameEcdsaTarget(left.target, right.target) && left.targetClientPublicKey33B64u === right.targetClientPublicKey33B64u;
 }
 function linkedEcdsaNormalSigningStatesEqual(left, right) {
 	return left.kind === right.kind && sameRouterAbEcdsaDerivationNormalSigningScopeV1(left.scope, right.scope);
@@ -148,6 +143,28 @@ async function buildActiveRuntime(args) {
 	} catch (error) {
 		return blocked("authority_identity_mismatch", error instanceof Error ? error.message : String(error));
 	}
+	const runtime = {
+		kind: "active_wallet_authority_ecdsa_runtime_v1",
+		walletId: args.selected.authority.walletId,
+		authorityId: args.selected.authority.authorityId,
+		walletAuthMethodId: args.selected.authMethod.walletAuthMethodId,
+		authorityDigestB64u: args.selected.authority.authorityDigestB64u,
+		factorAuthorityRef,
+		authorityRevocationEpoch: args.selected.authority.revocationEpoch,
+		walletSessionId: args.operationCredential.walletSessionId,
+		operationCredential: args.operationCredential,
+		session: args.session,
+		requiredCapability: args.requiredCapability,
+		materialActivation: args.materialActivation,
+		ecdsaThresholdKeyId: key.ecdsaThresholdKeyId,
+		relayerKeyId,
+		authority: args.selected.authority,
+		authMethod: args.selected.authMethod,
+		holderRuntime: args.holderRuntime,
+		normalSigning,
+		key,
+		publicFacts
+	};
 	if (args.selected.authMethod.kind === "passkey") {
 		const auth = {
 			kind: "passkey",
@@ -164,26 +181,7 @@ async function buildActiveRuntime(args) {
 			})
 		});
 		return {
-			kind: "active_wallet_authority_ecdsa_runtime_v1",
-			walletId: args.selected.authority.walletId,
-			authorityId: args.selected.authority.authorityId,
-			walletAuthMethodId: args.selected.authMethod.walletAuthMethodId,
-			authorityDigestB64u: args.selected.authority.authorityDigestB64u,
-			factorAuthorityRef,
-			authorityRevocationEpoch: args.selected.authority.revocationEpoch,
-			walletSessionId: args.operationCredential.walletSessionId,
-			operationCredential: args.operationCredential,
-			session: args.session,
-			requiredCapability: args.requiredCapability,
-			materialActivation: args.materialActivation,
-			ecdsaThresholdKeyId: key.ecdsaThresholdKeyId,
-			relayerKeyId,
-			authority: args.selected.authority,
-			authMethod: args.selected.authMethod,
-			holderRuntime: args.holderRuntime,
-			normalSigning,
-			key,
-			publicFacts,
+			...runtime,
 			auth,
 			factorAuthority: args.factorAuthority,
 			resolvedKey
@@ -195,49 +193,14 @@ async function buildActiveRuntime(args) {
 		providerSubjectId: String(args.factorAuthority.factor.providerUserId)
 	};
 	return {
-		kind: "active_wallet_authority_ecdsa_runtime_v1",
-		walletId: args.selected.authority.walletId,
-		authorityId: args.selected.authority.authorityId,
-		walletAuthMethodId: args.selected.authMethod.walletAuthMethodId,
-		authorityDigestB64u: args.selected.authority.authorityDigestB64u,
-		factorAuthorityRef,
-		authorityRevocationEpoch: args.selected.authority.revocationEpoch,
-		walletSessionId: args.operationCredential.walletSessionId,
-		operationCredential: args.operationCredential,
-		session: args.session,
-		requiredCapability: args.requiredCapability,
-		materialActivation: args.materialActivation,
-		ecdsaThresholdKeyId: key.ecdsaThresholdKeyId,
-		relayerKeyId,
-		authority: args.selected.authority,
-		authMethod: args.selected.authMethod,
-		holderRuntime: args.holderRuntime,
-		normalSigning,
-		key,
-		publicFacts,
+		...runtime,
 		auth,
 		factorAuthority: args.factorAuthority
 	};
 }
 function projectActiveRuntime(args) {
 	if (!args.chainTarget) return null;
-	if (args.runtime.auth.kind === "passkey") {
-		if (!args.runtime.resolvedKey) return null;
-		return {
-			kind: "active_wallet_authority_ecdsa_lane_projection_v1",
-			source: "active_wallet_authority",
-			chainTarget: args.chainTarget,
-			runtime: args.runtime,
-			key: args.runtime.key,
-			materialActivation: args.runtime.materialActivation,
-			publicFacts: args.runtime.publicFacts,
-			state: "deferred",
-			authorizationState: "authorization_required",
-			auth: args.runtime.auth,
-			resolvedKey: args.runtime.resolvedKey
-		};
-	}
-	return {
+	const lane = {
 		kind: "active_wallet_authority_ecdsa_lane_projection_v1",
 		source: "active_wallet_authority",
 		chainTarget: args.chainTarget,
@@ -246,7 +209,18 @@ function projectActiveRuntime(args) {
 		materialActivation: args.runtime.materialActivation,
 		publicFacts: args.runtime.publicFacts,
 		state: "deferred",
-		authorizationState: "authorization_required",
+		authorizationState: "authorization_required"
+	};
+	if (args.runtime.auth.kind === "passkey") {
+		if (!args.runtime.resolvedKey) return null;
+		return {
+			...lane,
+			auth: args.runtime.auth,
+			resolvedKey: args.runtime.resolvedKey
+		};
+	}
+	return {
+		...lane,
 		auth: args.runtime.auth
 	};
 }

package/dist/esm/core/signingEngine/session/material/ecdsaCapabilityManifest.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { isoTimestampFromUnixMs } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveSigningRootId, normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseEcdsaActivationDigest, parseEcdsaLifecycleId } from "../../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRegistrationRecipientKeys, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 //#region src/core/signingEngine/session/material/ecdsaCapabilityManifest.ts
 var EcdsaCapabilityManifestProof = class {
 	retainProof() {
@@ -224,6 +224,10 @@ var ReplacedEcdsaCapabilityManifestProof = class extends EcdsaCapabilityManifest
 		this.retirement = fields.retirement;
 	}
 };
+function unwrapDomainId(result) {
+	if (!result.ok) throw new Error(result.error.message);
+	return result.value;
+}
 function buildEcdsaCapabilityScope(input) {
 	assertUniqueEcdsaTargetMemberships(input.targetMemberships);
 	return new EcdsaCapabilityScopeProof([...input.targetMemberships]);
@@ -464,20 +468,8 @@ function assertDurableMaterialMatchesActivation(durableMaterial, activationBindi
 		receipt: receipt.protocolReceipt
 	});
 }
-function routerAbEcdsaPublicIdentitiesEqual(left, right) {
-	return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
-}
-function routerAbServerIdentitiesEqual(left, right) {
-	return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
-}
-function routerAbEcdsaSignerSetsEqual(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && routerAbServerIdentitiesEqual(left.selected_server, right.selected_server);
-}
-function routerAbEcdsaRecipientKeysEqual(left, right) {
-	return left.deriver_a.role === right.deriver_a.role && left.deriver_a.key_epoch === right.deriver_a.key_epoch && left.deriver_a.public_key === right.deriver_a.public_key && left.deriver_b.role === right.deriver_b.role && left.deriver_b.key_epoch === right.deriver_b.key_epoch && left.deriver_b.public_key === right.deriver_b.public_key;
-}
 function routerAbEcdsaDerivationPublicCapabilitiesEqual(left, right) {
-	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && routerAbEcdsaPublicIdentitiesEqual(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && routerAbEcdsaSignerSetsEqual(left.signer_set, right.signer_set) && routerAbEcdsaRecipientKeysEqual(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
+	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && sameRegistrationSignerSet(left.signer_set, right.signer_set) && sameRegistrationRecipientKeys(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
 }
 function assertNormalSigningMatchesActivation(input) {
 	const scope = input.normalSigning.scope;
@@ -492,7 +484,7 @@ function assertNormalSigningMatchesActivation(input) {
 		lifecycleBinding: expectedMaterialActivation.lifecycleBinding,
 		signingWorker: expectedMaterialActivation.signingWorker
 	});
-	if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !routerAbEcdsaPublicIdentitiesEqual(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !routerAbServerIdentitiesEqual(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) throw new Error("ECDSA normal-signing runtime does not match its activation");
+	if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !sameRouterAbServerIdentityV1(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) throw new Error("ECDSA normal-signing runtime does not match its activation");
 }
 function assertValidEcdsaReplacement(active, replacement) {
 	if (active.identity.manifestId === replacement.identity.manifestId || Number(replacement.identity.manifestRevision) !== Number(active.identity.manifestRevision) + 1 || active.signer.capability !== replacement.signer.capability || active.signer.signerId !== replacement.signer.signerId || active.signer.walletId !== replacement.signer.walletId || active.signer.authority.authorityDigest !== replacement.signer.authority.authorityDigest || active.signer.materialOwner !== replacement.signer.materialOwner || active.durableMaterial.durableMaterialRef === replacement.durableMaterial.durableMaterialRef || active.activation.serverActivation.serverGeneration === replacement.activation.serverActivation.serverGeneration) throw new Error("ECDSA replacement manifest does not exactly replace the active manifest");
@@ -501,6 +493,6 @@ function assertNever(value) {
 	throw new Error(`Unexpected ECDSA capability branch: ${String(value)}`);
 }
 //#endregion
-export { buildActiveEcdsaCapabilityManifest, buildDurableEcdsaMaterialBinding, buildEcdsaActivationBinding, buildEcdsaCapabilityScope, buildEcdsaManifestIdentity, buildEcdsaRoleLocalMaterialBinding, buildEcdsaServerActivationCommit, buildEncryptedEcdsaPendingCandidate, buildExactEcdsaManifestExpectation, buildExactEcdsaServerGenerationExpectation, buildNoCurrentEcdsaManifestExpectation, buildNoCurrentEcdsaServerGenerationExpectation, buildPreparedEcdsaActivationCandidate, buildPreparedEcdsaActivationJournal, buildPreparedEvmFamilySigner, buildReplacedEcdsaCapabilityManifest, buildServerCommittedEcdsaActivationJournal, buildValidatedEncryptedEcdsaReadyMaterial, routerAbEcdsaDerivationPublicCapabilitiesEqual };
+export { buildActiveEcdsaCapabilityManifest, buildDurableEcdsaMaterialBinding, buildEcdsaActivationBinding, buildEcdsaCapabilityScope, buildEcdsaManifestIdentity, buildEcdsaRoleLocalMaterialBinding, buildEcdsaServerActivationCommit, buildEncryptedEcdsaPendingCandidate, buildExactEcdsaManifestExpectation, buildExactEcdsaServerGenerationExpectation, buildNoCurrentEcdsaManifestExpectation, buildNoCurrentEcdsaServerGenerationExpectation, buildPreparedEcdsaActivationCandidate, buildPreparedEcdsaActivationJournal, buildPreparedEvmFamilySigner, buildReplacedEcdsaCapabilityManifest, buildServerCommittedEcdsaActivationJournal, buildValidatedEncryptedEcdsaReadyMaterial, routerAbEcdsaDerivationPublicCapabilitiesEqual, unwrapDomainId };
 
 //# sourceMappingURL=ecdsaCapabilityManifest.js.map

package/dist/esm/core/signingEngine/session/material/ecdsaSealedRuntime.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
+import { sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest.js";
 //#region src/core/signingEngine/session/material/ecdsaSealedRuntime.ts
 function blocked(reason) {